Where are infected e-mails?

[dj-test]

Where can I find infected e-mails that Avast blocked? I just get a message that the e-mail was infected (and very often it's not) - so where can I find these messages to restore them?

[DavidR]

It entirely depends on what avast said was detected, when they were detected (on-access, inbound email or on-demand scan) and what action you selected when they were detected.

Without this information everything is speculation ?

If you sent them to the chest, I think you can write them off as it is virtually impossible to insert this email into a database file where the email would be stored.

What is your email client ?

[dj-test]

On last occasion Avast said that there was ''suspicious whitespace'' (whatever that's supposed to mean).

It was detected when the message was received in Outlook Express (inbound mail). I didn't set any action because is set to automatically clean and delete as secondary action (if cleaning fails).

[DavidR]

White space (plain old spaces), lots of them can be used to obscure something, e.g. push it outside the viewing area. This could be malicious or just poor use by the sender.

Presumably you have the Pro version as I don't believe this option is available to the Home version. I doubt that it would be repairable so it would then according to your actions, repair, if fails, delete, then the email is history/gone/is no more.

If this was an inbound email that was being scanned it is scanned outside the email folders, so a deletion would simply discard the email and it wouldn't end up in the deleted emails folder, etc.

[dj-test]

Yeah, I found in another post here that this means spaces in att. filename. I disabled that option and hopefully everything would be fine now.

But is there no way to set Avast to store infected e-mails somewhere?

[hines232]

DavidR, Dose the pro.version of avast check for virus in (Out Look Express), with out using stunnel, or what ever it is 

[DavidR]

Yeah, I found in another post here that this means spaces in att. filename. I disabled that option and hopefully everything would be fine now.

But is there no way to set Avast to store infected e-mails somewhere?

Personally ignoring the symptom rather than treating the disease isn't a preferred option. It is entirely in your power to accept an infected email, by not having a delete option in your auto processing, but I think that is a mistake as you might as well disable scanning if you are going to (as part of auto processing) accept infected emails.

You could disable auto processing and instead have interactive input, but that would alert and wait your decision to either allow (ignore) or take action, whichever choice you decide.

DavidR, Dose the pro.version of avast check for virus in (Out Look Express), with out using stunnel, or what ever it is 

STunnel only has anything to do with SSL email and as such doesn't have any bearing on the Pro or Home versions ability to scan Outlook Express email, unless that email is SSL (secure encrypted) email.

[alanrf]

But is there no way to set Avast to store infected e-mails somewhere?

The only standards that exist for emails is their format when they are actually in the process of being transmitted.

Sorry, but the fact is that the world does not support the independent existence of emails or their attachments unless they are within the myriad of databases belonging to all of the email servers and clients in existence and for which there is no standard.

[DavidR]

Thanks for picking up on that Alan, I missed the 'somewhere' bit.

But is there no way to set Avast to store infected e-mails somewhere?

So in this case, the only somewhere to store it is to allow (take no action) the infected email to be saved in the inbox with all the associate issues of having an infected email in the .dbx file.

Now if you had MS Outlook (not express) you would be using the Outlook/Exchange provider then there is an option on Virus Storing, where you could send it to a folder you create specially for that purpose, see image.